Splunk Search

Why does our heavy forwarder host_regex configuration work for Linux, but not Windows?

murikadan
Path Finder

We are having issues getting Splunk to process log files in windows, The identical configuration works in linux.

Appreciate any help in identifying what the problem could be

This does not work

[batch://E:\DATA\FTP\*.log.gz]
host_regex = E:\DATA\FTP\[A-Z]+_(?:(?:(?:[a-z]+_)|(?:[a-z]+_\d+_)))([a-z]+\d+)_+\d+\.log\.gz
sourcetype = bluecoat:proxysg:access:file
index = ip-bluecoat
move_policy = sinkhole
disabled = false

This works

[batch:///home/ec2-user/temp/*.log.gz]
host_regex = /home/ec2-user/temp/[A-Z]+_(?:(?:(?:[a-z]+_)|(?:[a-z]+_\d+_)))([a-z]+\d+)_+\d+\.log\.gz
sourcetype = bluecoat:proxysg:access:file
index = ip-bluecoat
move_policy = sinkhole
disabled = false

Sample log file names:
AB_main_abc123_20151124230023.log
AB_main_2_abc123__2341124210817.log

Splunk version is 6.3

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Have you tried escaping your backslashes?

host_regex = E:\\DATA\\FTP\\[A-Z]+_(?:(?:(?:[a-z]+_)|(?:[a-z]+_\d+_)))([a-z]+\d+)_+\d+\.log\.gz
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Have you tried escaping your backslashes?

host_regex = E:\\DATA\\FTP\\[A-Z]+_(?:(?:(?:[a-z]+_)|(?:[a-z]+_\d+_)))([a-z]+\d+)_+\d+\.log\.gz
---
If this reply helps you, Karma would be appreciated.

murikadan
Path Finder

@richgalloway, Yes tried escaping backslashes, no change.

0 Karma

ChloeMica
New Member

I have tried but got nothing changed too. Any other ways for that?

0 Karma

murikadan
Path Finder

@ChloeMica, If you are defining source explicitly in inputs.conf then splunk uses that string to match not the original filename.
"Detail: This feature examines the source key; if source is set explicitly in the stanza, that string will be matched, not the original filename." - http://docs.splunk.com/Documentation/Splunk/6.3.1/Admin/Inputsconf
Could that be your case ?

0 Karma

murikadan
Path Finder

Thanks this solution indeed works!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...